bug: "Module not loaded" reported for modules that loaded correctly

The issue is in warnings.go's unresolvedModules() function, comparing terraform.Block.ID(). The root cause involves block expansion and cloning in parser/load_module.go and pkg/iac/terraform/block.go. Start by examining the linked PR for the fix approach, then look at the testdata/lateexpansion fixture to reproduce. Understanding the module loading flow and the ID() vs ModuleKey() distinction is key. Done means the warning no longer appears for correctly loaded modules.

Summary

unresolvedModules() in warnings.go emits

Module not loaded. Did you run `terraform init`?
Module 'module "claude_code[0]"' in file ".terraform/modules/workspace/main.tf:26,1-21" cannot be resolved. This module will be ignored.

for modules that resolved, contributed all of their blocks, and rendered all of
their parameters. Reported by a customer on Coder v2.34.9 with a registry
sourced module; reproduced from source on preview@main.

Root cause

The check compares terraform.Block.ID() between the enumerated module block
and the ModuleBlock() pointer the module's own blocks captured. In the pinned
trivy fork ID() is a per-instance UUID (pkg/iac/terraform/block.go:92) that
Clone() regenerates, and a module block is cloned whenever count or
for_each is expanded.

Expansion can happen after the module's blocks captured their pointer:

1. EvaluateAll expands blocks while the count/for_each value is still
   unknown, so the original block stays in e.blocks.
2. loadModules expands a copy of the module block list
   (parser/load_module.go:38) and does not write it back. The submodule's
   blocks capture that clone.
3. The post-submodule evaluateSteps() expands e.blocks again, now that the
   value is known, putting a different clone into the evaluated set.

The two instances can never compare equal, so the warning is unconditional. Any
module gated on a value that resolves late is affected; the gate does not have
to be visible at the module's own call site.

Reproduction

module "gate" { source = "./modules/gate" }          # outputs enabled = true

module "ai" {
  source = "./modules/ai"
  count  = module.gate.enabled ? 1 : 0               # resolves late
}

preview -d . --log-level error reports module "ai[0]" as unresolved, and no
Failed to load module line is logged at any level, because the module did
load. Full fixture in the linked PR (testdata/lateexpansion).

Evidence that the graph is intact

Instrumenting preview.Preview after EvaluateAll on a template with nine
declared module blocks:

• all nine keys in .terraform/modules/modules.json are loaded;
• every resource address in terraform plan is present in the evaluated graph,
  including those inside the flagged modules;
• three of the nine module blocks have content but are not marked used by
  ID(), while ModuleKey() marks all of them used;
• the flagged modules' parameters render, including one three modules deep.

Impact

DiagnosticModuleNotLoaded is warning level, so the render succeeds with a
reduced parameter set. On Coder releases without coder/coder#29108 that can cost
stored parameter values (coder/coder#29099). On current main the guard is
present, and there the false positive instead pins affected templates into
"incomplete render" permanently, which suppresses cleanup of values for
parameters the template genuinely removed. Either way the diagnostic is
load bearing and currently unreliable.

Fix

Key the comparison on the declaration rather than the block instance. See the
linked PR.

Known remaining case

A module whose blocks are all removed during expansion (for example a single
resource with for_each = {}) contributes nothing to the graph and is still
reported as not loaded. That is the "completely empty module" limitation the
existing code comment acknowledges. Fixing it properly means returning the
evaluator's real load failures
(parser/load_module.go:47 logs them at Error level and nothing returns them)
instead of inferring resolution. Worth a separate issue.

---

Filed by Coder Agents on behalf of @angrycub.